Files
Termix/electron/external-editor.cjs
T
ZacharyZcR 25e58a6425 fix(desktop): harden external editor and session cookie IPC (#1627)
* fix(desktop): stop the renderer choosing the external editor binary or reading the session cookie

open-external-editor now launches only the editor saved from a file dialog
and refuses to hand executable file types to the OS opener. The unused
get-session-cookie and wait-session-cookie channels, which returned the
httpOnly jwt, are removed.

* fix: validate setting keys before editor authorization
2026-10-14 08:22:15 +08:00

71 lines
1.3 KiB
JavaScript

const path = require("path");
// Saved by the file manager after the user picks an editor in a file dialog.
const EXTERNAL_EDITOR_SETTING = "fileManager.externalEditorPath";
// Extensions the OS would run rather than open in an editor. With no editor
// configured the temp copy goes to shell.openPath, and its name comes from
// the remote server.
const LAUNCHABLE_EXTENSIONS = new Set([
// Windows
"application",
"appref-ms",
"bat",
"chm",
"cmd",
"com",
"cpl",
"exe",
"gadget",
"hta",
"inf",
"jar",
"js",
"jse",
"library-ms",
"lnk",
"msc",
"msi",
"msp",
"mst",
"pif",
"ps1",
"psd1",
"psm1",
"py",
"pyw",
"reg",
"scf",
"scr",
"search-ms",
"settingcontent-ms",
"url",
"vbe",
"vbs",
"ws",
"wsf",
"wsh",
"xll",
// macOS
"app",
"command",
"pkg",
"terminal",
"tool",
"workflow",
// Linux
"appimage",
"desktop",
"run",
"sh",
]);
function isLaunchableFileName(fileName) {
// Windows drops trailing dots and spaces, so "a.exe. " is saved as a.exe.
const name = path.basename(String(fileName || "")).replace(/[. ]+$/, "");
const extension = path.extname(name).slice(1).toLowerCase();
return LAUNCHABLE_EXTENSIONS.has(extension);
}
module.exports = { EXTERNAL_EDITOR_SETTING, isLaunchableFileName };